Insights · 21 September 2026 · 6 min read
What the regulators actually ask of an insurance company in Iraq
Three laws, three regulators and a calendar of reports that most companies know only in part. Here is the map we use with every insurer we work with.
By Dr. Wissam Mattout
When we start work with an insurance company in Iraq, the first question is always the same: who asks you for what, and when? The answer is rarely written down in one place. It sits in three laws and in the habits of three regulators. So we put it on one page. This is that page.
Three laws
- The Insurance Business Regulation Law no. 10 of 2005. It makes the board responsible for the company's solvency and for the accuracy of what is reported to the Insurance Diwan. Not the compliance officer. The board.
- The Anti-Money Laundering and Counter-Terrorism Financing Law no. 39 of 2015. It requires customer due diligence, monitoring of suspicious transactions and timely reporting, and it attaches consequences to the leadership when reporting and control fail.
- The Companies Law no. 21 of 1997. It defines what board members owe to shareholders and to the official bodies, including the annual list of shareholders under article 126.
Three regulators
- The Insurance Diwan receives the periodic financial reports, the quarterly compliance report and the annual governance report, and it inspects.
- The Central Bank of Iraq receives the suspicious-transaction reports and expects a working AML/CFT function with a named reporting officer.
- The Ministry of Finance, through the companies registrar, receives the annual filings: shareholders, changes in ownership and in the board, licence and registration renewals.
What goes wrong
The pattern repeats across companies of every size. Reports arrive late or incomplete. Replies to inspectors' observations are weak, because nobody owns the observation. The risk register exists, but nobody has updated it since the consultant left. And every report costs a new consulting fee.
None of this is a knowledge problem. The people in these companies are capable. It is a practice problem: nobody trained them on the real template, with real data, until they could do it alone.
What we do about it
Two things. For staff, a programme that trains the compliance, AML, risk and audit people to prepare each report themselves, on the real form, and to defend it in front of an inspector. For boards, two days that put the personal legal responsibility on the table and teach leaders to read a report before they sign it.
If you want the one-page map for your own company, write to us. We will send it, no strings attached.